What is the CVSS score of CVE-2026-60143?

CVE-2026-60143 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-60143?

Oracle E-Business Suite Workflow Notification Mailer (versions 12.2.3-12.2.15) is vulnerable to unauthorized remote access by unauthenticated attackers, enabling theft of workflow data and partial…

How to fix or mitigate CVE-2026-60143?

Within 24 hours: identify all systems running Oracle E-Business Suite versions 12.2.3 through 12.2.15 and confirm Workflow Notification Mailer deployment; restrict network access to the Notification Mailer to internal networks only and disable HTTP in favor of HTTPS-only connectivity. Within 7 days: implement network segmentation to isolate the Workflow Notification Mailer from untrusted and external networks; enable comprehensive audit logging of all Workflow component data access; and deploy Web Application Firewall rules to restrict Workflow endpoint exposure. Within 30 days: monitor Oracle's July 2026 Critical Patch Update release for CVE-2026-60143 mitigation and apply immediately upon availability to all affected instances. No vendor-released patch identified at time of analysis.

Oracle E-Business Suite CVE-2026-60143

EUVD-2026-46551 HIGH

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-vgxp-xq69-qgm7

Authentication Bypass Denial Of Service Oracle Oracle Workflow Oracle Corporation

7.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

7.3 HIGH

HTTP-reachable, unauthenticated, low-complexity per Oracle (AV:N/AC:L/PR:N/UI:N); impacts limited to a subset of data and partial DoS, so C/I/A each Low with no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:13 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

HIGH 7.3

DescriptionCVE.org

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Workflow. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Workflow accessible data as well as unauthorized read access to a subset of Oracle Workflow accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Workflow. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).

AnalysisAI

Unauthorized data access and partial denial of service in Oracle E-Business Suite's Oracle Workflow component (Workflow Notification Mailer), versions 12.2.3 through 12.2.15, lets a remote unauthenticated attacker read a subset of Workflow data, perform limited update/insert/delete operations, and partially disrupt the service over HTTP. Oracle rates it CVSS 3.1 7.3 and flags it as 'easily exploitable' with no authentication required. No public exploit is identified at time of analysis and it is not listed in CISA KEV, though its low-friction network vector warrants prompt patching in the July 2026 Critical Patch Update.

Technical ContextAI

The affected component is the Workflow Notification Mailer, the subsystem within Oracle Workflow (part of Oracle E-Business Suite EBS 12.2.x) that sends and receives email notifications tied to workflow processes, typically communicating over SMTP/IMAP and exposed via HTTP-facing EBS servlets. Oracle assigned no CWE (listed N/A), but the described impact - partial reads plus limited write and DoS reachable without authentication over HTTP - is consistent with an input-validation or access-control weakness in the mailer's HTTP-reachable interface rather than full data compromise. The single CPE, cpe:2.3:a:oracle_corporation:oracle_workflow:*:*:*:*:*:*:*:*, confirms Oracle Workflow as the affected package, and the constrained C:L/I:L/A:L impacts indicate the attacker touches only a subset of Workflow-accessible data rather than the whole EBS instance.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the primary and vendor-sanctioned remediation for all affected 12.2.3-12.2.15 releases; Oracle strongly recommends applying CPU patches without delay. An exact standalone fix version is not enumerated in the provided data beyond the CPU reference, so treat 'Patch available per vendor advisory' as the patch status and map the correct patch to your EBS 12.2.x level from the CPU. Until patching, compensating controls include restricting network access to the Workflow Notification Mailer and EBS HTTP endpoints to trusted networks/VPN and placing them behind a reverse proxy or WAF that filters malformed requests, disabling outbound/inbound mailer processing if the notification-mailer function is not in active use (trade-off: workflow email notifications stop), and tightening egress/ingress on the SMTP/IMAP and HTTP ports the mailer uses. These controls reduce exposure but do not close the underlying flaw, so patching remains required.